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DETAILED ACTION 
Response to Arguments 

Election/Restrictions 

• Applicant's election with traverse of Group I in the reply filed on 12/20/05 is 
acknowledged. The traversal is on the ground(s) that a thorough search and examination of 
either claim group would be relevant to the examination of the other group. This is not found 
persuasive because the invention of groups I and II are independent and there would be a 
serious burden on the examiner if restriction was not required. 

As indicated in the previous Action, group I is drawn to a method for providing access 
based on user profiles by creating user profile, electronic profile for data, establishing rule and 
method for accessing. Group II is drawn to a method of generating a database and the 
database comprises pre-established criteria, applications data including system administrator 
defined attributes, user data includes a user's organization and citizenship and predetermined 
rules and methodologies data. These two groups are independent the examiner has to do two 
different thorough search, one for a method for providing access based on user profiles, and 
one for a database comprises pre-established criteria, applications data including system 
administrator defined attributes, user data includes a user's organization and citizenship and 
predetermined rules and methodologies data. 

The requirement is still deemed proper and is therefore made FINAL. 

• This application contains claim 16 drawn to an invention nonelected with traverse 
in Paper filed on 12/20/05. A complete reply to the final rejection must include cancellation of 
nonelected claims or other appropriate action (37 CFR 1 .144) See MPEP § 821 .01. 
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Claim Rejections - 35 USC S 112 

Applicants 1 arguments with respect to the rejection of claims 1 and 5 under 35 U.S.C § 
112, first paragraph, have been fully considered and are persuasive in view of the amendment. 
The rejection of claims 1 and 5 under 35 U.S.C § 1 12, first paragraph, has been withdrawn. 

Claim Rejections - 35 USC $ 101 

Applicants' arguments with respect to the rejection of claim 16 under 35 U.S.C. § 101 
have been fully considered. The rejection of claim 16 under 35 U.S.C. § 101 has been 
withdrawn in view of the withdrawal of claim 16. 

Claim Rejections - 35 USC S 103 

• Applicants' arguments with respect to the rejection of claims 1 and 3-4 under 35 
U.S.C. § 103 have been fully considered but they are not persuasive. 
As argued by applicants: 

(a) At page 9: 

. . . neither Kraenzel nor Behera, considered alone or in combination, describe or suggest a method that includes 
automatically determining, using an internal exception access process an approval or a disapproval of quick 
access based on pre-established criteria and the list of data for approval 

(b) At page 11: 

Applicants respectfully traverse the assertion in the Office Action at page 12, lines 18-20, that 
"fijnstead of granting access as indicated at boxes 152-156, an internal exception access process is 
implemented at boxed 162-166 for quick approval " This assertion is in contrast with Kraenzel that 
describes that additional privileges are requested from a system administrator, which is the object 
author or manager and not an internal exception access process as recited in Claim L Applicants 
respectfully submit that a system administrator can not fairly be considered an internal exception 
access process. For at least the reasons above, Applicants respectfully submit that Claim I is 
patentable over Kraenzel in view of Behera. 
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(c) At page 1 1 : 

Claims 3 and 4 depend from independent Claim I, which is submitted to be in condition for 
allowance. When the recitations of Claims 3 and 4 are considered in combination with the recitations 
of Claim 1, Applicants submit that dependent Claims 3 and 4 are also patentable over Kraenzel in view 
ofBehera. 

Examiner respectfully disagrees. 

(a) As shown in FIG. 3 of Kraenzel, if the user is denied access indicating by NO branch 
of box 156, box 162 determines if the user has requested for additional privileges, a YES and 
NO requests prompting the user to select is implied at this box. Instead of granting access as 
indicated at boxes 152-156, an internal exception access process is implemented at boxed 162-166 for 
quick approval. As disclosed at Col. 4, Lines 22-23, the request for access contains one or more 
objects requested by a user. Thus, the requested object as a list of data for approval is included in the 
quick approval request at box 162. Referring back to FIG. 3, the YES and NO branch of box 162 

indicates the Claimed limitation automatically determining, using an internal exception access process, an 

approval or a disapproval of quick access. As shown in box 166, the additional privileges of the 
requested objects are determined by the YES and NO branch of box 166. In different words, an 

approval or a disapproval of quick access is determined based on pre-established criteria and the list of data for 
approval. 

(b) The internal exception access process as claimed is equated with the process at boxes 
162-166, and is not in contrast with Kraenzel because the additional privileges are requested 
from a user, and granted by the system administrator. 

(c) Claims 2-4 are also rejected with the reasons as discussed above. 
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• Applicants' arguments with respect Kraenzel in view of Behera from page 1 1 to 
page 12 have been considered but are moot in view of the new ground(s) of rejection. 

• Applicants' arguments with respect Kraenzel in view of CERN and Lillibridge from 
page 12 to page 15 have been fully considered but they are not persuasive as discussed above 
in view of claim 1 . 

• In response to applicant's argument that there is no suggestion to combine the 
references, the examiner recognizes that obviousness can only be established by combining or 
modifying the teachings of the prior art to produce the claimed invention where there is some 
teaching, suggestion, or motivation to do so found either in the references themselves or in the 
knowledge generally available to one of ordinary skill in the art. See In re Fine, 837 F.2d 1071 , 
5 USPQ2d 1596 (Fed. Cir. 1988) and In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 
1992). In this case, CERN teaches an OHR application and Lillibridge teaches an RFCA 
Application (Lillibridge, Col. 8, lines 35-46). The user profile as taught by Kraenzel could be 
used to include the information available from either an Oracle Human Resource Application or 
a request for Computer Access Application. 

• Applicants' arguments with respect to the rejection of claims 5-14 have been fully 
considered but they are not persuasive. 

Regarding to Claim 5, Kraenzel teaches a method for managing a user profile information 
(Kraenzel, Abstract) including managing access control to applications and data by implementing a level of 
security across the different applications that is the same for each application (Kraenzel, Col. 1 , Lines 1 3-26) 
using a web-based system that includes a server system coupled to a centralized interactive database and at least 
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one client system (Col. 1, Lines 13-26, ACL is a centralized interactive database coupled with 
server/client system). The Kraenzel method comprises the steps of: 

providing capabilities for a user to request access to information that the user currently does not have 

access to (As shown in FIG. 3, after making an object request access at box 152 and if user 
privilege does not meet minimum requirement for object requested at box 156, additional 
privilege can be requested and processed by boxes 162-168); 

tracking a status of the request using a tracking component coupled to the centralized interactive database 
(as illustrated at Kraenzel FIG. 3, after making a request access at box 152, a status of the 
request, either YES for retrieving object at box 158 or NO for requesting additional privileges at 
box 162, Col. 4, Lines 20-35, is tracked by Access Determining Object 24, Col. 3, Lines 5-7, as a 
tracking component included in Profile System 14. Access Determining Object 24 is coupled to an 

ACL as centralized interactive database, Col. 2, Lines 14-16); 

obtaining a decision from an owner of the data requested (additional privilege is determined by 
system administrator to have YES/NO branch, Col. 4, Lines 37-39); 

Referring back to Kraenzel FIG. 3, user privilege is determined again at box 156, if the 
user is denied access indicating by NO branch of box 156, box 162 determines if the user has 
requested for additional privileges, a YES and NO requests prompting the user to complete the request 
far additional privileges as quick approval is implied at this box. As disclosed at Col. 2, Lines 12-15 
and Col. 4, Lines 22-23, the request for access contains one or more objects requested by a 
user, and the requested objects are files or documents. Thus, the requested objects contain at . 
least keywords for identifying the request files or documents such as files names. In different 

words, a list of the information the user is requesting access to for approval \S included in the quick approval 
request at box 162; 
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The YES and NO branches of box 162 as an internal exception access process, which indicate 

the Steps Of automatically determining an approval or a disapproval of quick access. The determination is 

based on additional privileges as pre-established criteria and the requested objects that contain 
information for identifying the request files or documents as the list of the information the user is 

requesting access to\ 

if the request for quick approval is approved, at least one of automatically adding a rule to the database 

and automatically adding a user to the database (if additional privileges have been granted, ACL is 
updated (Col. 4, Lines 38-39). User profile is added or updated in accordance with the updated 
ACL (Col. 3, Lines 3-5). A rule can be added to the user profile database (Col. 4, Lines 11-13). 
A new use profile could be added to the user profile database (Col. 3, Lines 1-42)); 

if the rule is added, updating an exception list (Col. 4, Lines 3-1 3); and 
notifying the user of the approval (Col. 4, Lines 38-41). 

• Applicants' arguments with respect to the rejection of claim 15 have been fully 
considered but are moot in view of the new ground(s) of rejection. 

Claim Objections 

Claim 1 is objected to because of the following informalities: the database at line 17 (the 
centralized database is respectfully suggested). Appropriate correction is required. 

Claim Rejections - 35 USC § 101 

35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 
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Claims 1 and 5 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. 



Regarding claim 1 , the method of providing access to users does not produce a useful, 
concrete and tangible result as set forth in MPEP 2106 (IV)(B)(2)(b)(ii) 1 . The claim limitation, 



after the Step Of making a decision, begins with "if the user is denied access... if the request for quick approval 



is approved... if the rule is added.,. n will not perform in the process when the conditional statement is 



not satisfied. In different words, "if the user is approved", the method is stopped after "making a 



decision" step. Therefore, the claimed invention does not have a useful result because the 



request for access is not provided "if the user is approved". The claimed invention does not 



produce a concrete and tangible result because the result from the approval condition is still 



unknown. The step of "making a decision" is not a concrete and tangible result because the result 



from the decision is unknown and not being used in the process. 



Regarding claim 5, the method of providing access to users does not produce a useful, 
concrete and tangible result as set forth in MPEP 2106 (IV)(B)(2)(b)(ii). A method for managing user 



profile information, including managing access control to applications... by implementing a level of security across 
the different applications that is the same for each application was recited in the preamble, but there is no 



claim limitation illustrates the management of user profile information in the body of the claim. 



1 MPEP 2106 (IV)(B)(2)(b)(ii): 

For such subject matter to be statutory, the claimed process must be bunted to a practical 
application of* the abstract idea or mathematical algorithm in the technological arts. See 
A lappa t, 33 F.3d at 1543, 31 USPQ2d at 1556-57 (quoting Diamond v. Diehr, 450 
U.S. at 192, 209 USPQ at lO). See also Alappat 33 F.3d at 1569. 3 1 USPQ2d at 
1578-79 (Newman, J., concurring) ('Ympatentabilxty of the principle does not defeat 
patentability of its practical applications") (citing O 'Re illy v. Aforso, 56 U.S. (15 How.) 
at 1 14-19). A claim is Kraft ed to a practical application when the method, as claimed, 
produces a concrete, tangible and useful result; Le., the method recites a step or act of 
producing something that is concrete, tangible and useful. See <AT <&T. 172 F.3d at 1358. 
SO USPQ2d at 1452. Likewise, a machine claim is statutory when the machine, as 
claimed, produces a concrete, tangible and useful result (as irk State Street, 149 F.3d at 
1373, 47 USPQ2d at 1601) and/or when a specific machine is being claimed (as in 
Alappar, 33 F.3d at 1544. 31 USPQ2d at 1557 (*> banc). For example, a 

computer process that simply calculates a mathematical algorithm that models noise is 
nonstatutory. However, a claimed process for digitally filtering noise employing the 
mathematical algorithm is statutory. 
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Neither applications, nor a level of security across the different applications that is the same for each application 

is implemented. The claim limitation, after the step of obtaining a decision, begins with "if the user is 

denied access.,, if the request for quick approval is approved... if the rule is added... n Will not perform in the 

process when the conditional statement is not satisfied. In different words, "if the user is 
approved", the method is stopped after "obtaining a decision" step. Therefore, the claimed 
invention does not have a useful result because the request for access is not provided "if the 
user is approved". The claimed invention does not produce a concrete and tangible result 
because the result from the approval condition is still unknown. The step o\" obtaining a decision is 
not a concrete and tangible result because the result from the decision is unknown and not 
being used in the process. 

Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claims 1 and 5 are rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 

As in claim 1, the user in the step of notifying references to a plurality of users, e.g., one 
at line 5 and one at line 17. It is unclear what user is being referenced. The step of adding a user 
to the database makes the claim indefinite because one user is request for access, and another 
user is added to the database. 
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As in claim 5, 

the request in the step of tracking a status references to a some other items in the claim. It 
is unclear what item is being referenced; 

the data requested in the step of obtaining a decision references to a some other items in 
the claim. It is unclear what item is being referenced; 

the quick access request in the step of automatically determining references to a some other 
items in the claim. It is unclear what item is being referenced. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

Claims 1,3-11 and 13-15 are rejected under 35 U.S.C. 102(e) as being anticipated 
by Kraenzel [USP 6,513,039]. 

Regarding Claim 1 , Kraenzel teaches a method for providing access to users based on user 
profiles (Kraenzel, Abstract) and using a web-based system that includes a server system coupled to a 
centralized interactive database and at least one client system (Col. 1, Lines 13-26, ACL is a centralized 

interactive database coupled with server/client system). 
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creating an electronic profile for a user within a centralized database (an electronic user profile is 

created by profile system 14 (Col. 3, Lines 1-2) within the profile system as a centralized database 
(Col. 2, Lines 50-56)); 

creating an electronic profile for data within the centralized database (Access Control List as 
electronic profile for data within the profile system as a centralized database (Col. 3, Lines 4-14)); 

establishing pre-determined rules and methodology for user access (inferencing rules as pre- 
determined rules and access privileges, e.g., read-only access, as methodology for user access are 
established (Col. 4, Lines 6-1 3)); 

making a decision with reference to the user access after completing an evaluation based on the 
electronic profiles, pre-determined rules, and operating methodology in response to a request from the user for 

access (As shown in FIG. 3, in order to grant access to a requested object or making a decision with 

reference to the user access, and the procedure is processed as at Step 1 56-1 58, in response to a request 

from the user for access, to complete an evaluation based on inferencing rules to retrieve key words in the 
user profile and determine access privileges (Col. 4, Lines 6-1 1 ) for comparing with access 

privileges in ACL (Col. 4, Lines 22-26) as the electronic profiles, pre-determined rules, and operating 

methodology (Col. 4, Lines 25-31 )). 

In regard to the limitation if the user is denied access, prompting the user to complete the request for 
quick approval wherein the request for quick approval includes a list of data for approval; automatically 
determining, using an internal exception access process, an approval or a disapproval of quick access based on 
pre-established criteria and the list of data for approval; if the request for quick approval is approved, at least one 
of automatically adding a rule to the database and automatically adding a user to the database; if the rule is 
added, updating an exception list; and notifying the user of the approval, SUCh limitation has been 

interpreted as a conditional statement wherein the steps following the conditional statement are 
only performed when the specified condition has been met. The steps are not performed when 
the condition has not been met. Therefore, the steps following the conditional statement have 
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been interpreted as being optional. Claim scope is not limited by claim language that suggests 
or makes optional but does not require steps to be performed (MEPE 21 1 1 .04). 

In this case, when the access request is approved, the process of providing access is 
stopped after the step of making a decision. 

Regarding claim 1 , Kraenzel teaches a method for providing access to users based on user 
profiles (Kraenzel, Abstract) and using a web-based system that includes a server system coupled to a 
centralized interactive database and at least one client system (Col. 1, Lines 13-26, ACL is a centralized 
interactive database coupled with server/client system). 

creating an electronic profile for a user within a centralized database (an electronic user profile is 

created by profile system 14 (Col. 3, Lines 1-2) within the profile system as a centralized database 
(Col. 2, Lines 50-56)); 

creating an electronic profile for data within the centralized database (Access Control List as 
electronic profile for data within the profile system as a centralized database (Col. 3, Lines 4-14)); 

establishing pre-determined rules and methodology for user access (inferencing rules as pre- 
determined rules and access privileges, e.g., read-only access, as methodology for user access are 
established (Col. 4, Lines 6-13)); 

making a decision with reference to the user access after completing an evaluation based on the 
electronic profiles, pre-determined rules, and operating methodology in response to a request from the user for 

access (As shown in FIG. 3, in order to grant access to a requested object or making a decision with 

reference to the user access, and the procedure is processed as at Step 1 56-1 58, in response to a request 

from the user for access, to complete an evaluation based on inferencing rules to retrieve key words in the 
user profile and determine access privileges (Col. 4, Lines 6-1 1 ) for comparing with access 

privileges in ACL (Col. 4, Lines 22-26) as the electronic profiles, pre-determined rules, and operating 
methodology (Col. 4, Lines 25-31)); 



Application/Control Number: 09/842,577 c Page 13 

Art Unit: 2168 

if the user is denied access, prompting the user to complete the request for quick approval wherein the 
request for quick approval includes a list of data for approval (Referring back to Kraenzel FIG. 3, user 

privilege is determined again at box 1 56, if the user is denied access indicating by NO branch of box 
156, box 162 determines if the user has requested for additional privileges, a YES and NO 

requests prompting the user to complete the request for additional privileges 3S quick approval is implied 
at this box. As disclosed at Col. 2, Lines 12-15 and Col. 4, Lines 22-23, the request for access 
contains one or more objects requested by a user, and the requested objects are files or 
documents. Thus, the requested objects contain at least keywords for identifying the request 
files or documents such as files names. In different words, a list of data for approval is included in the 

quick approval request at box 1 62); 

automatically determining, using an internal exception access process, an approval or a disapproval of 
quick access based on pre-established criteria and the list of data for approval (The YES and NO branches 

Of box 1 62 as an internal exception access process, which indicate the Steps of automatically determining 

an approval or a disapproval of quick access. The determination is based on additional privileges as 
pre-established criteria and the requested objects that contain information for identifying the request 

files Or documents as the list of data for approval)] 

if the request for quick approval is approved, at least one of automatically adding a rule to the database 
and automatically adding a user to the database (if additional privileges have been granted, ACL is 
updated (Col. 4, Lines 38-39). User profile is added or updated in accordance with the updated 
ACL (Col. 3, Lines 3-5)); 

if the rule is added, updating an exception list (As specified in the conditional statement, either 
adding a rule or adding a user should be performed. If a user is added, this step is not 
performed); 

notifying the user of the approval (Col. 4, Lines 38-41 ). 
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Regarding claim 3, Kraenzel and Behera, in combination, teach all of the claimed subject 
matter as discussed above with respect to claim 1 , Kraenzel further discloses the step of creating 

data profiles based on at least one of Data Elements, Data Tags, Rules of Access, an Approver's Name for Each 
Rule of Access, Rules of Exclusion, an Exception List, and Field Tags (Kraenzel, Col. 1 , lines 1 3-26). 

Regarding claim 4, Kraenzel teaches all of the claimed subject matter as discussed 
above with respect to claim 3, Kraenzel further discloses the step of establishing pre-determined 

rules in the centralized database based on at least one of Rule Based Access guidelines, Group Based Access 
guidelines, Search & Subscribe Utilities guidelines, Active Positioning Monitoring guidelines, Hard Exclusion 
Rules guidelines, and Access Audits guidelines (Col. 3, Lines 61-65, inferencing rules as Rule Based 
Access guidelines is established); and establishing methodology to ensure timely and accurate decision making 
based on criteria established by the management (Col. 3, Lines 56-58, access privilege as methodology is 
established. The purpose is to ensure timely and accurate decision making based on criteria established by 
the management). 

Regarding to Claim 5, Kraenzel teaches a method for managing a user profile information 
(Kraenzel, Abstract) including managing access control to applications and data by implementing a level of 
security across the different applications that is the same for each application (Kraenzel, Col. 1 , Lines 1 3- 
26) using a web-based system that includes a server system coupled to a centralized interactive database and at 

least one client system (Col. 1, Lines 13-26, ACL is a centralized interactive database coupled with 
server/client system). The Kraenzel method comprises the steps of: 

providing capabilities for a user to request access to information that the user currently does not have 

access to (As shown in FIG. 3, after making an object request access at box 152 and if user 
privilege does not meet minimum requirement for object requested at box 156, additional 
privilege can be requested and processed by boxes 162-168); 
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tracking a status of the request using a tracking component coupled to the centralized interactive 

database (as illustrated at Kraenzel FIG. 3, after making a request access at box 152, a status of 
the request, either YES for retrieving object at box 158 or NO for requesting additional privileges 
at box 162, Col. 4, Lines 20-35, is tracked by Access Determining Object 24, Col. 3, Lines 5-7, as 
a tracking component included in Profile System 14. Access Determining Object 24 is coupled to an 

ACL as centralized interactive database, Col. 2, Lines 14-16); 

obtaining a decision from an owner of the data requested (additional privilege is determined by 
system administrator to have YES/NO branch, Col. 4, Lines 37-39). 

In regard to the limitation if the user is denied access, prompting the user to complete the request for 
quick approval wherein the request for quick approval wherein the request for quick approval includes a list of 
the information the user is requesting access to for approval; automatically determining, using an internal 
exception access process, an approval or a disapproval of quick access based on pre-established criteria and the 
list of information the user is requesting access to; if the request for quick approval is approved, at least one of 
automatically adding a rule to the database and automatically adding a user to the database; if the rule is added, 
updating an exception list; and notifying the user of the approval, SUCh limitation has been interpreted as 

a conditional statement wherein the steps following the conditional statement are only 
performed when the specified condition has been met. The steps are not performed when the 
condition has not been met. Therefore, the steps following the conditional statement have been 
interpreted as being optional. Claim scope is not limited by claim language that suggests or 
makes optional but does not require steps to be performed (MEPE 21 1 1 .04). 

In this case, when the access request is approved, the process of providing access is 
stopped after the step of obtaining a decision. 

Regarding to Claim 5, Kraenzel teaches a method for managing a user profile information 
(Kraenzel, Abstract) including managing access control to applications and data by implementing a level of 



Application/Control Number: 09/842,577 Page 16 

Art Unit: 2168 

security across the different applications that is the same for each application (Col. 1 , Lines 1 3-26) using a 
web-based system that includes a server system coupled to a centralized interactive database and at least one 

client system (Col. 1, Lines 13-26, ACL is a centralized interactive database coupled with 
server/client system). The Kraenzel method comprises the steps of: 

providing capabilities for a user to request access to information that the user currently does not have 
access to (As shown in FIG. 3, after making an object request access at box 152 and if user 
privilege does not meet minimum requirement for object requested at box 156, additional 
privilege can be requested and processed by boxes 162-168); 

tracking a status of the request using a tracking component coupled to the centralized interactive 

database (as illustrated at Kraenzel FIG. 3, after making a request access at box 152, a status of the 
request, either YES for retrieving object at box 158 or NO for requesting additional privileges at 
box 162, Col. 4, Lines 20-35, is tracked by Access Determining Object 24, Col. 3, Lines 5-7, as a 
tracking component included in Profile System 14. Access Determining Object 24 is coupled to an 

ACL as centralized interactive database, Col. 2, Lines 14-16); 

obtaining a decision from an owner of the data requested (additional privilege is determined by 

system administrator to have YES/NO branch, Col. 4, Lines 37-39); 

Referring back to Kraenzel FIG. 3, user privilege is determined again at box 156, if the 
user is denied access indicating by NO branch of box 156, box 162 determines if the user has 
requested for additional privileges, a YES and NO requests prompting the user to complete the request 
far additional privileges as quick approval is implied at this box. As disclosed at Col. 2, Lines 12- 
15 and Col. 4, Lines 22-23, the request for access contains one or more objects requested by a 
user, and the requested objects are files or documents. Thus, the requested objects contain at 
least keywords for identifying the request files or documents such as files names. In different 
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words, a list of the information the user is requesting access to for approval is included in the quick approval 
request at box 162; 

The YES and NO branches of box 162 as an internal exception access process, which indicate 

the Steps Of automatically determining an approval or a disapproval of quick access. The determination is 

based on additional privileges as pre-established criteria and the requested objects that contain 
information for identifying the request files or documents as the list of the information the user is 

requesting access to\ 

if the request for quick approval is approved, at least one of automatically adding a rule to the database 

and automatically adding a user to the database (if additional privileges have been granted, ACL is 
updated (Col. 4, Lines 38-39). User profile is added or updated in accordance with the updated 
ACL (Col. 3, Lines 3-5)); 

if the rule is added, updating an exception list (As specified in the conditional statement, either 
adding a rule or adding a user should be performed. If a user is added, this step is not 
performed); 

notifying the user of the approval (Col. 4, Lines 38-41 ). 

Regarding claim 6, Kraenzel teaches all the claim subject matters as discussed above 
with respect to claim 5, Kraenzel further discloses the step of obtaining at least one of an approval 

decision and a disapproval decision (Col. 4, lines 20-43). 

Regarding claim 7, Kraenzel teaches all the claim subject matters as discussed above 

With respect to Claim 5, Kraenzel further discloses the Step Of reviewing and auditing the user access 

(Col. 4, lines 20-43). 
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Regarding claim 8, Kraenzel teaches all the claim subject matters as discussed above 

With respect to Claim 5, Kraenzel further discloses the Step Of creating a consistent security model that 
includes centralized administration of security of the system and uses single user profile and privilege for 
accessing different applications (Col. 3, lines 1-15; Col. 4, lines 20-43). 

Regarding claim 9, Kraenzel teaches all the claim subject matters as discussed above 
with respect to claim 5, Kraenzel further discloses the step of creating user profiles; providing access 

control to data associated with user profiles; defining permissions based on a user identifier associated with user 
profiles; and developing a specification for user interfaces (Col. 3, line 1-Col. 4, line 13). 

Regarding claim 10, Kraenzel teaches all the claim subject matters as discussed above 
with respect to claim 5, Kraenzel further discloses the step providing administration of a common 

security model for access control and event notification (FIG. 3). 

Regarding claim 11, Kraenzel teaches all the claim subject matters as discussed above 
with respect to claim 5, Kraenzel further discloses the step of updating profiles automatically on at 

least one of a pre-determined timed interval and a change in organization hierarchy (Col. 3, lines 33-42). 

Regarding claim 13, Kraenzel teaches all the claim subject matters as discussed above 
with respect to claim 5, Kraenzel further discloses the step of generating access list reports that 

identify accessible and non-accessible data and restrictions for access (Kraenzel, Col. 1 , lines 20-26 and 
Col. 2, lines 12-16). 
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Regarding claim 14, Kraenzel teaches all the claim subject matters as discussed above 
with respect to claim 5, Kraenzel further discloses the step of retrieving information from the 

centralized database in response to a specific inquiry from an administrator (Kraenzel, Col. 4, lines 20-43). 

Regarding claim 15, Kraenzel teaches all the claim subject matters as discussed above 

With respect to Claim 5, Kraenzel further discloses the client system and the server system are connected 
via a network and wherein the network is one of a wide area network, a local area network, an intranet and the 
internet (Col 2, Lines 1-3, the network as disclosed by Kraenzel is a network includes either a 
wide are or local are network). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

This application currently names joint inventors. In considering patentability of the 

claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the various 

claims was commonly owned at the time any inventions covered therein were made absent any 

evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1 .56 to point out 

the inventor and invention dates of each claim that was not commonly owned at the time a later 

invention was made in order for the examiner to consider the applicability of 35 U.S.C. 103(c) 

and potential 35 U.S.C. 102(e), (f) or (g) prior art under 35 U.S.C. 103(a). 
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Claim 2 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kraenzel 
[USP 6,513,039] in view of Behera [USP 6,535,879], CERN [Administrative Information 
Services, Oracle HR] and Lillibridge [USP 6,195,698 B1]. 

Regarding claim 2, Kraenzel and Behera, in combination, teach all of the claimed subject 
matter as discussed above with respect to claim 1 , but fails to disclose the step of creating an 

electronic profile based on information available from at least one an OHR Application and an RFCA 
Application. CERN teaches an OHR application and Lillibridge teaches an RFCA Application 
(Lillibridge, Col. 8, lines 35-46). Therefore, it would have been obvious for one of ordinary skill in 
the art at the time the invention was made to modify the Kraenzel and Behera method by using 
information from OHR Application and RFCA Application to build the electronic profile in order to 
distribute object to a user or a group via IP address. 

Claim 12 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kraenzel 
[USP 6,513,039], 

Regarding claim 12, Kraenzel teaches all the claim subject matters as discussed above 
with respect to claim 5, Kraenzel does not explicitly teach the step of updating profiles automatically 
when a user transfers departments. However, as disclosed by Kraenzel, profile system 14 may 
automatically update a user's profile by periodically checking the ACL of the network. This may 
be performed on a routine basis, or on a random basis, when requested by a system 
administrator, or at various other instances. System 14 may also use the above process for 
updating a user profile by simply adding supplemental information to the user profile (Kraenzel, 
Col. 3, lines 33-42). Thus, when a user transfers departments, system administrator updates the 
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ACL, and user profile will be updated automatically. Therefore, it would have been obvious for 
one of ordinary skill in the art at the time the invention was made to modify the Kraenzel and 
Stockwell method by including the step of updating profiles when a user transfers department in 
order to control access to a database. 
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Conclusion 

Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to HUNG Q. PHAM whose telephone number is 571-272-4040. The 
examiner can normally be reached on Monday-Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, TIM T. VO can be reached on 571-272-3642. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-21 7-9197 (toll-free). If you 
would like assistance from a USPTO Customer Service Representative or access to the 
automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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